CVE-2026-32741

CVE-2026-32741 describes a heap buffer overflow vulnerability found in `libheif`, a library responsible for decoding and encoding HEIF (High Efficiency Image File Format) and AVIF files. The flaw specifically resides within the `MaskImageCodec::decode_mask_image()` function. When processing a HEIF file that includes a mask image (mski), the `memcpy` function attempts to copy data into a pixel buffer. The size of the data to be copied is determined by an attacker-controlled value within the file's `iloc` extent, while the destination buffer's size is based on the declared image dimensions. A lack of an upper-bound check on the data length allows a specially crafted file to provide an `iloc` extent that exceeds the allocated pixel buffer, resulting in a heap overflow. This vulnerability is triggered when the `mskC` property specifies 8 bits per pixel and the `ispe` property declares an even width of 64 or greater. The issue has been addressed in `libheif` version 1.22.0.